🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58
SHA3-384 hash: cb4ba7c3d081666ba98ec7a79d63c95ce31d86d132d00f2f6915f13316fa3b422db330d96b59add3acc2b06c20a41ab6
SHA1 hash: 58c8ab83211eea0d02c4689c0e72108b4d05f97f
MD5 hash: 6804c35b71d3ee6c1e95f0b345483568
humanhash: steak-nitrogen-six-london
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-06 04:17:18 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:cKNEKG0YF4m6QqsheRDl4GMGAU3qAXNPJv0KGAyR0q:cuEK5ozqEa3qAXNPJv0Kc
TLSH T15E31609F14611A315503CA4E73A3758C668D91F73E9FD7D498980EAA93883CCF2A2F4D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/2e74den/an/an/a
http://5.182.210.174/4cac5fn/an/an/a
http://5.182.210.174/93a9bcn/an/an/a
http://5.182.210.174/7dd495n/an/an/a
http://5.182.210.174/476d4cn/an/an/a
http://5.182.210.174/bc6520n/an/an/a
http://5.182.210.174/2f0ee1n/an/an/a
http://5.182.210.174/7a423bn/an/an/a
http://5.182.210.174/4e71a4n/an/an/a
http://5.182.210.174/379dadn/an/an/a
http://5.182.210.174/95d212n/an/an/a
http://5.182.210.174/85e2a7n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9ce992210e2a6307d5f343/reports/a8b289dc-f0b2-4866-9a3a-8cefcdcea619/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-06T02:22:00Z UTC
Last seen:
2026-09-06T03:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2d591cf8-5624-4c83-ba2b-48270afa0038
Behavior Graph:
Download SVG
%3 guuid=e89a59ed-1600-0000-34fc-b0793a0c0000 pid=3130 /usr/bin/sudo guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136 /tmp/sample.bin guuid=e89a59ed-1600-0000-34fc-b0793a0c0000 pid=3130->guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136 execve guuid=78b9abf1-1600-0000-34fc-b079410c0000 pid=3137 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=78b9abf1-1600-0000-34fc-b079410c0000 pid=3137 execve guuid=9cb581f6-1600-0000-34fc-b079420c0000 pid=3138 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=9cb581f6-1600-0000-34fc-b079420c0000 pid=3138 execve guuid=aa501801-1700-0000-34fc-b079570c0000 pid=3159 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=aa501801-1700-0000-34fc-b079570c0000 pid=3159 execve guuid=de285c01-1700-0000-34fc-b079580c0000 pid=3160 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=de285c01-1700-0000-34fc-b079580c0000 pid=3160 clone guuid=5237d701-1700-0000-34fc-b0795a0c0000 pid=3162 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=5237d701-1700-0000-34fc-b0795a0c0000 pid=3162 execve guuid=25211b02-1700-0000-34fc-b0795b0c0000 pid=3163 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=25211b02-1700-0000-34fc-b0795b0c0000 pid=3163 execve guuid=94906402-1700-0000-34fc-b0795d0c0000 pid=3165 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=94906402-1700-0000-34fc-b0795d0c0000 pid=3165 execve guuid=6789ba04-1700-0000-34fc-b079650c0000 pid=3173 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=6789ba04-1700-0000-34fc-b079650c0000 pid=3173 execve guuid=39ada009-1700-0000-34fc-b079700c0000 pid=3184 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=39ada009-1700-0000-34fc-b079700c0000 pid=3184 execve guuid=f9d4df09-1700-0000-34fc-b079720c0000 pid=3186 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=f9d4df09-1700-0000-34fc-b079720c0000 pid=3186 clone guuid=508c4a0a-1700-0000-34fc-b079740c0000 pid=3188 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=508c4a0a-1700-0000-34fc-b079740c0000 pid=3188 execve guuid=0112a80a-1700-0000-34fc-b079760c0000 pid=3190 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=0112a80a-1700-0000-34fc-b079760c0000 pid=3190 execve guuid=edbae90a-1700-0000-34fc-b079770c0000 pid=3191 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=edbae90a-1700-0000-34fc-b079770c0000 pid=3191 execve guuid=7dc77d0d-1700-0000-34fc-b0797e0c0000 pid=3198 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=7dc77d0d-1700-0000-34fc-b0797e0c0000 pid=3198 execve guuid=795e2513-1700-0000-34fc-b0798a0c0000 pid=3210 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=795e2513-1700-0000-34fc-b0798a0c0000 pid=3210 execve guuid=097d8f13-1700-0000-34fc-b0798c0c0000 pid=3212 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=097d8f13-1700-0000-34fc-b0798c0c0000 pid=3212 clone guuid=b967da13-1700-0000-34fc-b0798f0c0000 pid=3215 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=b967da13-1700-0000-34fc-b0798f0c0000 pid=3215 execve guuid=a3683514-1700-0000-34fc-b079910c0000 pid=3217 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=a3683514-1700-0000-34fc-b079910c0000 pid=3217 execve guuid=6c8a9214-1700-0000-34fc-b079930c0000 pid=3219 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=6c8a9214-1700-0000-34fc-b079930c0000 pid=3219 execve guuid=84477417-1700-0000-34fc-b079990c0000 pid=3225 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=84477417-1700-0000-34fc-b079990c0000 pid=3225 execve guuid=62faa31d-1700-0000-34fc-b079a40c0000 pid=3236 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=62faa31d-1700-0000-34fc-b079a40c0000 pid=3236 execve guuid=8a464c1e-1700-0000-34fc-b079a60c0000 pid=3238 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=8a464c1e-1700-0000-34fc-b079a60c0000 pid=3238 clone guuid=9b3a0320-1700-0000-34fc-b079ac0c0000 pid=3244 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=9b3a0320-1700-0000-34fc-b079ac0c0000 pid=3244 execve guuid=44315c20-1700-0000-34fc-b079ae0c0000 pid=3246 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=44315c20-1700-0000-34fc-b079ae0c0000 pid=3246 execve guuid=24afb220-1700-0000-34fc-b079af0c0000 pid=3247 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=24afb220-1700-0000-34fc-b079af0c0000 pid=3247 execve guuid=f17ee223-1700-0000-34fc-b079b50c0000 pid=3253 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=f17ee223-1700-0000-34fc-b079b50c0000 pid=3253 execve guuid=19c20429-1700-0000-34fc-b079c00c0000 pid=3264 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=19c20429-1700-0000-34fc-b079c00c0000 pid=3264 execve guuid=3836e029-1700-0000-34fc-b079c30c0000 pid=3267 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=3836e029-1700-0000-34fc-b079c30c0000 pid=3267 clone guuid=3024dd2a-1700-0000-34fc-b079c70c0000 pid=3271 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=3024dd2a-1700-0000-34fc-b079c70c0000 pid=3271 execve guuid=5c59462b-1700-0000-34fc-b079ca0c0000 pid=3274 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=5c59462b-1700-0000-34fc-b079ca0c0000 pid=3274 execve guuid=61b2c62b-1700-0000-34fc-b079cc0c0000 pid=3276 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=61b2c62b-1700-0000-34fc-b079cc0c0000 pid=3276 execve guuid=1843b52e-1700-0000-34fc-b079d30c0000 pid=3283 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=1843b52e-1700-0000-34fc-b079d30c0000 pid=3283 execve guuid=f5cba332-1700-0000-34fc-b079e10c0000 pid=3297 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=f5cba332-1700-0000-34fc-b079e10c0000 pid=3297 execve guuid=74c4e032-1700-0000-34fc-b079e20c0000 pid=3298 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=74c4e032-1700-0000-34fc-b079e20c0000 pid=3298 clone guuid=c8190a33-1700-0000-34fc-b079e50c0000 pid=3301 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=c8190a33-1700-0000-34fc-b079e50c0000 pid=3301 execve guuid=4c6b4733-1700-0000-34fc-b079e70c0000 pid=3303 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=4c6b4733-1700-0000-34fc-b079e70c0000 pid=3303 execve guuid=86157e33-1700-0000-34fc-b079e90c0000 pid=3305 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=86157e33-1700-0000-34fc-b079e90c0000 pid=3305 execve guuid=593b7436-1700-0000-34fc-b079f10c0000 pid=3313 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=593b7436-1700-0000-34fc-b079f10c0000 pid=3313 execve guuid=4ce2783b-1700-0000-34fc-b079f30c0000 pid=3315 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=4ce2783b-1700-0000-34fc-b079f30c0000 pid=3315 execve guuid=b74ec83b-1700-0000-34fc-b079f40c0000 pid=3316 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=b74ec83b-1700-0000-34fc-b079f40c0000 pid=3316 clone guuid=d0ac103c-1700-0000-34fc-b079f70c0000 pid=3319 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=d0ac103c-1700-0000-34fc-b079f70c0000 pid=3319 execve guuid=2e666a3c-1700-0000-34fc-b079f90c0000 pid=3321 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=2e666a3c-1700-0000-34fc-b079f90c0000 pid=3321 execve guuid=66e7bd3c-1700-0000-34fc-b079fb0c0000 pid=3323 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=66e7bd3c-1700-0000-34fc-b079fb0c0000 pid=3323 execve guuid=d595733f-1700-0000-34fc-b079040d0000 pid=3332 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=d595733f-1700-0000-34fc-b079040d0000 pid=3332 execve guuid=26dbb643-1700-0000-34fc-b079150d0000 pid=3349 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=26dbb643-1700-0000-34fc-b079150d0000 pid=3349 execve guuid=26822244-1700-0000-34fc-b079170d0000 pid=3351 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=26822244-1700-0000-34fc-b079170d0000 pid=3351 clone guuid=2b497244-1700-0000-34fc-b079190d0000 pid=3353 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=2b497244-1700-0000-34fc-b079190d0000 pid=3353 execve guuid=d0aed644-1700-0000-34fc-b0791c0d0000 pid=3356 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=d0aed644-1700-0000-34fc-b0791c0d0000 pid=3356 execve guuid=67ee3745-1700-0000-34fc-b0791e0d0000 pid=3358 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=67ee3745-1700-0000-34fc-b0791e0d0000 pid=3358 execve guuid=bfd1a647-1700-0000-34fc-b079270d0000 pid=3367 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=bfd1a647-1700-0000-34fc-b079270d0000 pid=3367 execve guuid=7b696b4b-1700-0000-34fc-b079350d0000 pid=3381 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=7b696b4b-1700-0000-34fc-b079350d0000 pid=3381 execve guuid=e9a4ae4b-1700-0000-34fc-b079370d0000 pid=3383 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=e9a4ae4b-1700-0000-34fc-b079370d0000 pid=3383 clone guuid=3130ef4b-1700-0000-34fc-b0793a0d0000 pid=3386 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=3130ef4b-1700-0000-34fc-b0793a0d0000 pid=3386 execve guuid=50433e4c-1700-0000-34fc-b0793c0d0000 pid=3388 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=50433e4c-1700-0000-34fc-b0793c0d0000 pid=3388 execve guuid=46a0894c-1700-0000-34fc-b0793e0d0000 pid=3390 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=46a0894c-1700-0000-34fc-b0793e0d0000 pid=3390 execve guuid=37631d4f-1700-0000-34fc-b079480d0000 pid=3400 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=37631d4f-1700-0000-34fc-b079480d0000 pid=3400 execve guuid=8adc8552-1700-0000-34fc-b079560d0000 pid=3414 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=8adc8552-1700-0000-34fc-b079560d0000 pid=3414 execve guuid=352dbf52-1700-0000-34fc-b079570d0000 pid=3415 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=352dbf52-1700-0000-34fc-b079570d0000 pid=3415 clone guuid=9a27ec52-1700-0000-34fc-b0795a0d0000 pid=3418 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=9a27ec52-1700-0000-34fc-b0795a0d0000 pid=3418 execve guuid=a7113053-1700-0000-34fc-b0795c0d0000 pid=3420 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=a7113053-1700-0000-34fc-b0795c0d0000 pid=3420 execve guuid=72356853-1700-0000-34fc-b0795e0d0000 pid=3422 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=72356853-1700-0000-34fc-b0795e0d0000 pid=3422 execve guuid=99463056-1700-0000-34fc-b0796a0d0000 pid=3434 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=99463056-1700-0000-34fc-b0796a0d0000 pid=3434 execve guuid=4f35395a-1700-0000-34fc-b079730d0000 pid=3443 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=4f35395a-1700-0000-34fc-b079730d0000 pid=3443 execve guuid=bb6b7b5a-1700-0000-34fc-b079740d0000 pid=3444 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=bb6b7b5a-1700-0000-34fc-b079740d0000 pid=3444 clone guuid=4e28ab5a-1700-0000-34fc-b079760d0000 pid=3446 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=4e28ab5a-1700-0000-34fc-b079760d0000 pid=3446 execve guuid=c09ae85a-1700-0000-34fc-b079770d0000 pid=3447 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=c09ae85a-1700-0000-34fc-b079770d0000 pid=3447 execve guuid=e64d215b-1700-0000-34fc-b079780d0000 pid=3448 /usr/bin/wget net send-data guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=e64d215b-1700-0000-34fc-b079780d0000 pid=3448 execve guuid=1d698a5d-1700-0000-34fc-b0797f0d0000 pid=3455 /usr/bin/curl net send-data write-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=1d698a5d-1700-0000-34fc-b0797f0d0000 pid=3455 execve guuid=7fdab660-1700-0000-34fc-b0798a0d0000 pid=3466 /usr/bin/chmod guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=7fdab660-1700-0000-34fc-b0798a0d0000 pid=3466 execve guuid=84ebf560-1700-0000-34fc-b0798c0d0000 pid=3468 /usr/bin/bash guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=84ebf560-1700-0000-34fc-b0798c0d0000 pid=3468 clone guuid=43bd2b61-1700-0000-34fc-b0798e0d0000 pid=3470 /usr/bin/rm delete-file guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=43bd2b61-1700-0000-34fc-b0798e0d0000 pid=3470 execve guuid=46ef6f61-1700-0000-34fc-b079900d0000 pid=3472 /usr/bin/rm guuid=bf4b4ef0-1600-0000-34fc-b079400c0000 pid=3136->guuid=46ef6f61-1700-0000-34fc-b079900d0000 pid=3472 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=78b9abf1-1600-0000-34fc-b079410c0000 pid=3137->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9cb581f6-1600-0000-34fc-b079420c0000 pid=3138->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d2b7f01-1700-0000-34fc-b079590c0000 pid=3161 /usr/bin/bash guuid=de285c01-1700-0000-34fc-b079580c0000 pid=3160->guuid=5d2b7f01-1700-0000-34fc-b079590c0000 pid=3161 clone guuid=94906402-1700-0000-34fc-b0795d0c0000 pid=3165->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6789ba04-1700-0000-34fc-b079650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c63dfb09-1700-0000-34fc-b079730c0000 pid=3187 /usr/bin/bash guuid=f9d4df09-1700-0000-34fc-b079720c0000 pid=3186->guuid=c63dfb09-1700-0000-34fc-b079730c0000 pid=3187 clone guuid=edbae90a-1700-0000-34fc-b079770c0000 pid=3191->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7dc77d0d-1700-0000-34fc-b0797e0c0000 pid=3198->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9228ae13-1700-0000-34fc-b0798d0c0000 pid=3213 /usr/bin/bash guuid=097d8f13-1700-0000-34fc-b0798c0c0000 pid=3212->guuid=9228ae13-1700-0000-34fc-b0798d0c0000 pid=3213 clone guuid=6c8a9214-1700-0000-34fc-b079930c0000 pid=3219->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=84477417-1700-0000-34fc-b079990c0000 pid=3225->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=30c3961f-1700-0000-34fc-b079aa0c0000 pid=3242 /usr/bin/bash guuid=8a464c1e-1700-0000-34fc-b079a60c0000 pid=3238->guuid=30c3961f-1700-0000-34fc-b079aa0c0000 pid=3242 clone guuid=24afb220-1700-0000-34fc-b079af0c0000 pid=3247->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f17ee223-1700-0000-34fc-b079b50c0000 pid=3253->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=94024f2a-1700-0000-34fc-b079c50c0000 pid=3269 /usr/bin/bash guuid=3836e029-1700-0000-34fc-b079c30c0000 pid=3267->guuid=94024f2a-1700-0000-34fc-b079c50c0000 pid=3269 clone guuid=61b2c62b-1700-0000-34fc-b079cc0c0000 pid=3276->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1843b52e-1700-0000-34fc-b079d30c0000 pid=3283->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ccfcf232-1700-0000-34fc-b079e40c0000 pid=3300 /usr/bin/bash guuid=74c4e032-1700-0000-34fc-b079e20c0000 pid=3298->guuid=ccfcf232-1700-0000-34fc-b079e40c0000 pid=3300 clone guuid=86157e33-1700-0000-34fc-b079e90c0000 pid=3305->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=593b7436-1700-0000-34fc-b079f10c0000 pid=3313->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f0b7e73b-1700-0000-34fc-b079f50c0000 pid=3317 /usr/bin/bash guuid=b74ec83b-1700-0000-34fc-b079f40c0000 pid=3316->guuid=f0b7e73b-1700-0000-34fc-b079f50c0000 pid=3317 clone guuid=66e7bd3c-1700-0000-34fc-b079fb0c0000 pid=3323->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d595733f-1700-0000-34fc-b079040d0000 pid=3332->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4dc84644-1700-0000-34fc-b079180d0000 pid=3352 /usr/bin/bash guuid=26822244-1700-0000-34fc-b079170d0000 pid=3351->guuid=4dc84644-1700-0000-34fc-b079180d0000 pid=3352 clone guuid=67ee3745-1700-0000-34fc-b0791e0d0000 pid=3358->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bfd1a647-1700-0000-34fc-b079270d0000 pid=3367->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4032c44b-1700-0000-34fc-b079380d0000 pid=3384 /usr/bin/bash guuid=e9a4ae4b-1700-0000-34fc-b079370d0000 pid=3383->guuid=4032c44b-1700-0000-34fc-b079380d0000 pid=3384 clone guuid=46a0894c-1700-0000-34fc-b0793e0d0000 pid=3390->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=37631d4f-1700-0000-34fc-b079480d0000 pid=3400->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fa86d352-1700-0000-34fc-b079590d0000 pid=3417 /usr/bin/bash guuid=352dbf52-1700-0000-34fc-b079570d0000 pid=3415->guuid=fa86d352-1700-0000-34fc-b079590d0000 pid=3417 clone guuid=72356853-1700-0000-34fc-b0795e0d0000 pid=3422->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=99463056-1700-0000-34fc-b0796a0d0000 pid=3434->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8e768e5a-1700-0000-34fc-b079750d0000 pid=3445 /usr/bin/bash guuid=bb6b7b5a-1700-0000-34fc-b079740d0000 pid=3444->guuid=8e768e5a-1700-0000-34fc-b079750d0000 pid=3445 clone guuid=e64d215b-1700-0000-34fc-b079780d0000 pid=3448->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1d698a5d-1700-0000-34fc-b0797f0d0000 pid=3455->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53050e61-1700-0000-34fc-b0798d0d0000 pid=3469 /usr/bin/bash guuid=84ebf560-1700-0000-34fc-b0798c0d0000 pid=3468->guuid=53050e61-1700-0000-34fc-b0798d0d0000 pid=3469 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-09-06 04:18:12 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=psbgxppdimefjy352negjibsn2fflxyunxlecjqipmfhebywhzma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260906-eznanaxfpf/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments